A Review of Access Control Metamodels

Abstract

Abstract The emergence of ubiquitous computing, especially with the Internet of Things (IoT), releases new prospects to traditional information systems by merging new technologies and services for seamless access to information sources at anytime and anywhere. Concurrently, this emergence opens new threats to information security and new challenges to control access to the resources. To ensure security, several techniques have been employed, and access control (AC) is one of the essential security requirements for IoT and non-IoT systems. Various authentication and AC methods are proposed to enforce AC policy and to prevent any unauthorized access to logical/physical assets. The continuous technology upgrades and the diversity of AC models force the need to find AC metamodels with higher level of abstraction that serve as a unifying framework for specifying any AC policy. AC metamodels are proposed to encompass AC features and are used to derive various instances of AC models and methods. In this paper we review the proposed AC metamodels and their implementation scenarios, we analyze them, their objectives, their limitations, and present open research questions and issues that still need to be addressed.